A newly disclosed Linux vulnerability, dubbed 'copy.fail', poses a serious risk across multiple distributions, including Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and Fedora. Revealed by Theori on April 29, 2026, this local privilege escalation flaw allows attackers to manipulate the Linux kernel's crypto API to write unauthorized data into the page cache of files they do not own. Importantly, the exploit does not modify files on disk, making it difficult for traditional monitoring tools like AIDE and Tripwire to detect. This vulnerability is concerning because it affects a wide range of systems without requiring any specific modifications for different distributions. Organizations using these Linux variants should prioritize assessing their security posture and applying necessary mitigations to protect against potential exploitation.
A security researcher has introduced a tool called GhostLock that exploits a legitimate Windows file API to prevent access to files on local systems and SMB network shares. This proof-of-concept tool demonstrates how attackers could potentially block users from accessing important files, which could lead to significant disruptions in both personal and organizational environments. The ability to manipulate file access raises concerns for businesses relying on shared network drives and highlights the need for improved security measures to protect against such attacks. As this tool becomes known, companies and users alike may need to reassess their file access protocols and security practices to mitigate risks. The implications of this vulnerability could affect a wide range of Windows systems and applications that utilize the Windows file API.
A serious security vulnerability in cPanel, identified as CVE-2026-41940, is currently being exploited by a threat actor known as Mr_Rot13. This flaw allows attackers to bypass authentication and gain elevated control over cPanel and WebHost Manager (WHM) environments. The exploitation of this vulnerability has led to the deployment of a backdoor named Filemanager on compromised systems. This incident is particularly concerning because it puts web hosting environments at risk, potentially allowing unauthorized access to sensitive data and control over web applications. Users and administrators of affected cPanel and WHM versions need to be vigilant and take immediate action to secure their systems.
Instructure, the company behind the Canvas learning management system, has acknowledged that a security flaw was exploited by hackers to alter Canvas login portals. This breach allowed the attackers to leave an extortion message, raising serious concerns about the security of educational platforms used by schools and students. The incident underscores the vulnerability of widely used technologies in the education sector, as they can be targeted for malicious purposes. Users of Canvas, including students and educators, may face disruptions or potential data risks due to this security lapse. It's crucial for institutions to evaluate their security measures and ensure that similar vulnerabilities are patched to prevent future incidents.
A new vulnerability known as Dirty Frag has been discovered in the Linux kernel, raising alarms among security professionals. This bug could allow attackers to exploit systems running affected versions of the kernel, potentially leading to unauthorized access or control. Users and organizations that rely on Linux-based systems, particularly those using versions released in recent years, need to take immediate action to mitigate risks. As of now, there is no straightforward fix available, which adds to the urgency of the situation. It's crucial for system administrators to monitor updates from their Linux distributions and apply any available security patches as soon as they are released to protect their systems from potential exploitation.
Kaspersky researchers have released findings indicating that most passwords can be cracked in under a minute, based on an analysis of 231 million unique passwords leaked on the dark web between 2023 and 2026. This alarming statistic highlights the vulnerability of user accounts across various platforms, as many individuals continue to use weak or common passwords. The leaked data underscores the need for stronger password practices among users, such as adopting complex combinations or utilizing password managers. Additionally, organizations must consider implementing multi-factor authentication to enhance security. With the potential for quick exploitation of weak passwords, both individuals and businesses should take immediate steps to protect their online accounts.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
A vulnerability known as Dirty Frag has been discovered in Linux systems, which could allow attackers to gain root access. This flaw has been around for nine years and is particularly concerning because proof-of-concept (PoC) exploit code is now publicly available, increasing the risk of exploitation. Users and organizations running vulnerable Linux distributions should be aware that this could lead to severe security breaches if not addressed. It is crucial for system administrators to assess their systems for this vulnerability and take immediate action to mitigate potential threats. The ongoing presence of this flaw emphasizes the need for regular updates and vigilance in maintaining system security.
The article discusses the challenges faced by cybersecurity teams when defending networks, particularly during off-hours. It illustrates a scenario where analysts are overwhelmed with manual tasks, such as copying hashes into queries and rewriting scripts for the blue team’s use. The article points out that while all team members are performing their roles correctly, systemic issues hinder effective collaboration and timely responses to threats. This situation emphasizes the need for improved processes and tools to better integrate red and blue team efforts, ultimately enhancing overall security posture. The lack of efficiency in these operations can leave organizations vulnerable to attacks, especially when patch approvals take longer than the time it takes for a vulnerability to be exploited.
A new vulnerability in Linux, referred to as 'Dirty Frag' and tracked under CVE-2026-43284 and CVE-2026-43500, has been disclosed, raising concerns among security researchers and system administrators. This exploit could allow attackers to manipulate memory and potentially execute arbitrary code, impacting a wide range of Linux distributions. The vulnerability was made public before a patch was available, which increases the risk of exploitation by malicious actors. Users of affected systems need to be vigilant, as this vulnerability may already be utilized in attacks. It's crucial for organizations to stay updated and apply any patches as soon as they are released to mitigate potential risks.
The article discusses several cybersecurity topics, including new vulnerabilities and incidents. Notably, it mentions a zero-day exploit affecting Canvas, a learning management system used by educational institutions. This vulnerability could allow attackers to execute unauthorized code, putting sensitive student data at risk. Additionally, it highlights the QuasarRat malware, which has been observed in the wild, targeting various systems. The article also touches on compliance issues faced by companies like Anthropic regarding EU regulations, which can impact their operations. Overall, these developments serve as a reminder for organizations to stay vigilant and update their security measures regularly to protect against evolving threats.
A newly discovered zero-day vulnerability, dubbed 'Dirty Frag', affects most Linux distributions and allows attackers to escalate their privileges to root level. This means that a malicious actor could gain full control over a compromised system, putting sensitive data and operations at risk. The vulnerability is particularly concerning because it impacts a wide range of systems, making it a significant threat for both individual users and organizations that rely on Linux. Researchers are urging users and system administrators to take immediate action to secure their systems. The exact details of how this vulnerability can be exploited are still being analyzed, but the potential for active exploitation is high, prompting a call for swift remediation efforts.
A significant security incident has emerged involving U.S. military data exposed through a vulnerability in an open directory belonging to CMI Management Inc., a government contractor. This exposure was discovered following a tip-off to Cybernews, raising concerns about the potential accessibility of sensitive information. The data breach could have serious implications for national security, as it may include critical military-related information that should be kept confidential. Despite notifications from the Cybersecurity and Infrastructure Security Agency (CISA), the vulnerability remained unaddressed, highlighting lapses in data protection practices. The incident serves as a reminder for contractors handling government data to prioritize robust security measures and for agencies to ensure that vulnerabilities are promptly resolved.
Apache has addressed a serious vulnerability in its HTTP/2 implementation, identified as CVE-2026-23918, which has a CVSS score of 8.8. This vulnerability is a double-free error that could allow attackers to execute arbitrary code remotely. Any systems using the affected version of Apache's HTTP server could be at risk, which includes a wide range of web applications and services relying on this technology. It's crucial for organizations using Apache to apply the latest updates to prevent potential exploitation of this flaw. Users are advised to check their current versions and ensure they are running the patched releases to mitigate this risk effectively.
A new vulnerability in Linux, named 'Dirty Frag', has emerged, specifically affecting the xfrm-ESP and RxRPC modules. One of the flaws, identified as CVE-2026-43284, has already been patched in the Linux kernel, but the second flaw, CVE-2026-43500, remains unpatched. This situation poses a significant risk as attackers can exploit the unpatched vulnerability to gain root access to affected systems. The implications are serious, particularly for organizations using Linux systems that rely on these modules for secure networking. Users and system administrators are urged to apply the latest patches for the patched vulnerability and remain vigilant for updates regarding the unpatched issue.
The article discusses a common misconception in cybersecurity where organizations mistake vulnerability scanning for penetration testing. A survey by the SANS Institute found that over 60% of organizations confuse these two distinct practices. Vulnerability scanning involves identifying potential security weaknesses, while penetration testing simulates real-world attacks to exploit those vulnerabilities. This distinction is crucial for Chief Information Security Officers (CISOs) as reliance on scanning alone can leave organizations exposed to risks that a comprehensive penetration test would reveal. Understanding the difference can help improve security postures and better allocate resources to protect sensitive data.